Overview
CVE-2025-9625 identifies a Cross-Site Request Forgery (CSRF) vulnerability affecting the Coil Web Monetization plugin for WordPress. This vulnerability exists in versions up to and including 2.0.2. It allows unauthenticated attackers to potentially trigger CSS selector detection functionality by crafting a malicious request and tricking an administrator into executing it. This could lead to unauthorized actions performed on the website on behalf of the administrator.
Technical Details
The vulnerability stems from the insufficient or absent nonce validation for the `coil-get-css-selector` parameter within the `maybe_restrict_content` function of the Coil plugin. This means that an attacker can construct a malicious HTTP request containing this parameter and, if a logged-in administrator is tricked into clicking a link or loading a page containing this crafted request, the server will execute the request as if it originated from the administrator. The specific vulnerable code sections can be found in the referenced files within the Coil plugin repository.
Specifically, the issue resides in the following functions within the Coil plugin code:
- `maybe_restrict_content` function.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-9625 is 4.3, categorized as MEDIUM severity.
- CVSS Score: 4.3
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
This score reflects the fact that the attacker requires user interaction (i.e., tricking an administrator) to exploit the vulnerability, reducing the overall severity compared to vulnerabilities that can be exploited remotely without any user involvement.
Possible Impact
Successful exploitation of this CSRF vulnerability could allow an attacker to:
- Trigger the execution of arbitrary CSS selector detection.
- Potentially modify content or settings related to web monetization based on the executed CSS.
- Cause denial of service (DoS) by repeatedly triggering resource-intensive CSS selector detection.
The severity of the impact will depend on the specific functionality tied to the CSS selector detection within the Coil Web Monetization plugin and how it integrates with the WordPress website.
Mitigation and Patch Steps
The primary mitigation step is to update the Coil Web Monetization plugin to the latest available version. Versions after 2.0.2 should include a fix for this vulnerability, implementing proper nonce validation to prevent CSRF attacks. It’s crucial to apply security patches promptly to protect your WordPress website.
If an update is not immediately available, consider temporarily disabling the Coil Web Monetization plugin until a patched version can be installed. This will prevent potential exploitation of the vulnerability.
References
Coil Plugin Functions File (functions.php)
Coil Plugin Gating Functions File (functions.php – Line 195)
Coil Plugin Gating Functions File (functions.php – Line 202)
Wordfence Threat Intelligence Report
